mlsanityData to 7 Oct 2026

Stable Signature is Unstable: Removing Image Watermark from Diffusion Models

arXiv 2405.07145 ↗First posted 12 May 2024cs.CR cs.CVcited by 16

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Watermark has been widely deployed by industry to detect AI-generated images. A recent watermarking framework called Stable Signature (proposed by Meta) roots watermark into the parameters of a diffusion model's decoder such that its generated images are inherently watermarked. Stable Signature makes it possible to watermark images generated by open-source diffusion models and was claimed to be robust against removal attacks. In this work, we propose a new attack to remove the watermark from a diffusion model by fine-tuning it. Our results show that our attack can effectively remove the watermark from a diffusion model such that its generated images are non-watermarked, while maintaining the visual quality of the generated images. Our results highlight that Stable Signature is not as stable as previously thought.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 20 of its 31 references that are in the map. First posted on arXiv 12 May 2024.

Builds on

20 of 31 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
  2. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar

Other references · 18

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  7. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  8. 2021Cascaded Diffusion Models for High Fidelity Image Generationcited by 1,155
  9. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  10. 2018HiDDeN: Hiding Data With Deep Networkscited by 384
  11. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  12. 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 124
6 more
  1. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  2. 2020Distortion Agnostic Deep Watermarkingcited by 88
  3. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
  4. 2023Evading Watermark based Detection of AI-Generated Contentcited by 74
  5. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  6. 2020A Loss Function for Generative Neural Networks Based on Watson's Perceptual Modelcited by 39

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 5; 2026: 7.

16 papers.

Sort:

By area:

  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  2. 2024Optimizing Adaptive Attacks against Watermarks for Language Modelscited by 11
  3. 2024AI-generated Image Detection: Passive or Watermark?cited by 7
  4. 2024The Cat and Mouse Game: The Ongoing Arms Race Between Diffusion Models and Detection Methodscited by 4
  5. 2025VideoMarkBench: Benchmarking Robustness of Video Watermarkingcited by 4
  6. 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Surveycited by 4
  7. 2024Certifiably Robust Image Watermarkcited by 3
  8. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  9. 2025Smudged Fingerprints: A Systematic Evaluation of the Robustness of AI Image Fingerprintscited by 2
  10. 2026Proof-of-Authorship for Diffusion-based AI Generated Contentcited by 0
  11. 2026Diffusion Model Attribution via Spectral Coupling of Denoiser Responsescited by 0
  12. 2026Deepfakes and Synthetic Media: Generation, Detection, and Governancecited by 0
4 more
  1. 2026FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Modelscited by 0
  2. 2026Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removalcited by 0
  3. 2026Persistent Watermarking of Text-to-Image Modelscited by 0
  4. 2026Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Maskingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Attack-Resilient Image Watermarking Using Stable Diffusion
  2. 2025Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks
  3. 2026Vanishing Watermarks: Diffusion-Based Image Editing Undermines Robust Invisible Watermarking
  4. 2025On the Information-Theoretic Fragility of Robust Watermarking under Diffusion Editing
  5. 2025Diffusion-Based Image Editing for Breaking Robust Watermarks
  6. 2025Visual Watermarking in the Era of Diffusion Models: Advances and Challenges
  7. 2024CLUE-MARK: Watermarking Diffusion Models using CLWE
  8. 2024DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Model